Everyday Ghidra: Symbols — Automatic Symbol Acquisition with Ghidra — Part 2
This post, another lesson from the “Everyday Ghidra” series, walks through the process of configuring Ghidra to automatically download symbols from well known public symbol servers for several types of binaries. If you missed part 1, go back and see how symbols can help you see more clearly.
Automatic Symbol Acquisition with Ghidra
It doesn’t matter where symbols come from, as long as you can get them to help clean up your analysis. Ghidra offers the ability to automatically download symbols on your behalf. It takes some configuration, but it is really useful once you get going.
Public Symbol Servers
Ghidra has a list of servers it will reach out to for public symbol information, but you need to configure Ghidra to enable it, as the default settings won’t try. The list of symbol servers is available as a config file in the build.
If you review the stored urls in PDB_SYMBOL_SERVER_URLS.pdburl you will see several Windows symbol servers:
Internet|https://msdl.microsoft.com/download/symbols/|WARNING: Check your organization's security policy before downloading files from the internet.
Internet|https://chromium-browser-symsrv.commondatastorage.googleapis.com|WARNING: Check your organization's security policy before downloading files from the internet.
Internet|https://symbols.mozilla.org/|WARNING: Check your organization's security policy before downloading files from the internet.If you browse to any of the servers you will find different results. Some symbol server servers show a help page.
Others just some XML with paths to specific PDBs:
Just 4 months ago, Ghidra’s server list included 3 additional public symbol servers.
- Internet|https://software.intel.com/sites/downloads/symbols/|WARNING: Check your organization's security policy before downloading files from the internet.
- Internet|https://driver-symbols.nvidia.com/|WARNING: Check your organization's security policy before downloading files from the internet.
- Internet|https://download.amd.com/dir/bin|WARNING: Check your organization's security policy before downloading files from the internet.If we investigate a bit further, we can browse the files on Nvidia’s “symbol server”.
This server, although still called a symbol server, only contains binaries, no PDBs.
The Nvidia developer page explains the absence of PDBs and advises us to “enjoy”. While there is value (metadata, export names, etc.) in having versioned copies of the binaries for debugging, symbols are what we are after. Symbols are what bring us joy.
Configuring Ghidra to Leverage Remote Symbol Servers
Let’s try the servers with actual PDBs. You can configure Ghidra to leverage remote symbol servers, which can save you a step every time you analyze a new binary. Using Ghidra’s CodeBrowser click File → Edit → Symbol Server Config.
This will bring up the Symbol Server Search dialog:
You will need to configure your symbols directory, so it has a place to store the download PDBs. Select a local directory to store your symbols. It will ask you if you want to configure it as a Microsoft symbol storage directory.
Click yes. This will create a directory structure with two files:
% tree /tmp/symbols
/tmp/symbols
├── 000admin
└── pingme.txtThis structure matches the single tier directory structure that is one of the standard symbol server directory structures defined by Microsoft.
Normally files are placed in a single tier directory structure in which a single subdirectory exists for each filename cached. Under each filename folder, additional folders are made to store each version of the file. Symbol Store Folder Tree
The next step is to add specific servers and/or local directories that host PDB files. Click on the green ‘+’ button to add new servers.
This will provide a drop-down menu with several options.
Add a few of the suggested remote servers.
Once these are configured, Ghidra will use these servers to search for matching symbols for the binary that you are currently analyzing. It doesn’t need to have any special logic to identify the binary, rather, it goes out and checks each server to see if it contains a matching PDB file.
There are several ways to trigger the PDB download using the configured servers.
Load Symbols with Ghidra Manually
If you want to load symbols for your binary prior to analysis, you can force Ghidra to look for the symbols.
Within the CodeBrowser, click File → Load PDB.
This is will open the Load PDB dialog box.
The PDB location is blank, but we can fix this. If you click Advanced, you gain more options.
Click on Search All , which will tell Ghidra to go and check both remote and local symbol servers. When a PDB is found, whether it’s local or remote, the dialog box will update with a successful outcome.
Once you click Load, the PDB downloads to your local symbol store. Later, Ghidra will leverage the symbol information to improve analysis. Ghidra uses the single tier directory structure to store the PDB, just like on the public symbols servers.
% tree /tmp/symbols
/tmp/symbols
├── 000admin
├── afd.pdb
│ └── 14FBAE3662AD9F7B9D33AA9228D2554A1
│ └── afd.pdb
└── pingme.txtGhidra uses a well-known algorithm to figure out the correct download URL for Microsoft binaries. You can check this out for yourself here.
Alternate — Download Symbols with Microsoft’s Symchk
Alternatively, you could use a Microsoft provided tool to download symbols for your analysis and just add the local directory as a symbol server location. Check out the tool symchk. and run this command to download all the symbols files available in C:\Windows\System32. and cache them in C:\symbols
symchk /r /v /s SRV*c:\symbols*https://msdl.microsoft.com/download/symbols C:\Windows\System32Then just add the local directory to the list of available symbol locations:
Configure Ghidra to Automatically Download Symbols
There is a way to configure Ghidra to download symbols automatically during analysis. Changing the analysis options allows you to perform this action. Before you run analysis with the defaults, scroll down to PDB Universal and check the checkbox Search remote symbol servers.
When you check this, the analysis will run the code to download the PDB, similar to when we manually made Ghidra download the PDB in the Load PDB section above. After you click Analyze, the PDB will download and apply extra information to the binary. While it is possible to apply the PDB file after analysis is done, I’ve found that applying it beforehand gives the best outcomes.
How do I know that symbols have been loaded?
While in part 1, we saw specifically how symbols improve analysis, there are some general ways to determine if symbols have improved your analysis.
One quick way to check is to press Cmd + T / Ctrl + T to open up the Symbol Table Window. For general reverse engineering, I often jump here to navigate to specific function or search for useful names. Without symbols, most of your useful name will come from export names. The functions within the binary with have names like FUN_6758473.
Here is the Symbol Table window afd.sys without symbols:
There are 1714 identified symbols. These symbol include labels, identified function with random names, and some named externals.
Here is the Symbol Table with public symbols added:
There are now 2484 identified symbols, with external names and function names like AfdQueueTransmit that used to be called FUN_1c003f3ac .
Symbols are what bring us joy.
Another visual way to see more information available for your binary is to look at the quick summary scroll bar on the Listing Window. Notice the Listing window on the right has quite a bit more light color markers.
The markers that increased are analysis bookmarks. See the legend.
Save Custom Ghidra Analysis Options
Next time you are analyzing a binary that maps to a public symbol server, make sure you configure the analysis to leverage the remote PDBs to maximize the analysis results. If you want to use the same option(s) next time, you can save your analysis preferences.
Then the next time you run analysis, select your custom options.
Next Steps
This article provides a brief overview of Ghidra’s ability to download symbols automatically. For a deeper dive into my research and long form writing, head over to clearbluejar.github.io.
Everyday Ghidra
If you’re looking to get a foothold in reverse engineering using Ghidra, consider my upcoming training “Everyday Ghidra” with Ringzer0.
This course provides a comprehensive guide to using Ghidra, covering fundamental operations to advanced techniques, with hands-on exercises on real-world Windows applications. It’s designed for those with foundational Windows and security knowledge, aiming to equip them with practical “everyday” reverse engineering skills using Ghidra.
The next offering is a virtual course this July where we will explore Ghidra’s native tools and features that are essential for reverse engineering Windows binaries. Standard pricing ends June 30th, so register soon!
